Cascade routes any task through a cheap-to-expensive layer cascade — deterministic Python, symbolic graph reasoning, AST-validated codegen, failure-feedback pattern memory, governed CLI subprocess, then LLM provider. Every step gated against a 10-predicate safety conjunction. Every output stamped into an HMAC-chained receipt log. Every successful LLM call teaches the local layers so the next similar request never reaches the LLM at all.
LLM vendors win when usage grows. Cascade wins when usage shrinks.
Every LLM call trains the local layers to make the next call unnecessary.
A task entering Cascade is checked against a 10-gate predicate, then dispatched to the cheapest layer that can plausibly handle it. If that layer fails, it escalates. The expensive layer (L7 — LLM) is the last resort, not the default. Each successful LLM call is converted to a deterministic pattern stored in L6 — so the next similar request hits the cheap layer instead.
Before any layer runs, a zero-cost deterministic classifier reads the task and emits a routing plan: task type (codegen / system_op / reasoning / orchestration / trivial), which layer to start at, which provider to use at L7, and whether to decompose into sub-steps. A fast_path verdict restricts execution to L1 only. A deep_review verdict bypasses the cheap layers and forces L7 directly. A deny verdict blocks the task before the gate cycle runs — budget-exhausted requests never consume gate compute. Every routing decision is recorded on the receipt alongside the task result.
Deterministic Python emitter for high-frequency well-formed requests. No model invocation. Pure lookup-and-render. The cheapest possible answer the system can give.
A 22-edge symbolic graph for structured queries that exceed pure emission but resolve via graph traversal. Still deterministic; still no LLM cost.
AST-validated 10-stage pipeline for code generation tasks. Templates assemble syntax-correct Python; the AST validator gates malformed output before any execution. Production-grade governed codegen, no LLM call.
Failure-feedback pattern memory. Each successful LLM completion at L7 is converted into a parameterized template and indexed here. Subsequent similar requests hit L6 instead of L7 — the same answer at a fraction of the cost. This is where cost decay lives.
Cascade's structural differentiator. Any command-line tool on the host becomes a governed worker with hash-chained receipts. gh, gcloud, terraform, docker, kubectl, ollama, claude, codex, gemini, python, node, npm, pip — 23 adapters registered out of the box; new CLIs added by JSON edit, no source change. Destructive commands (terraform apply, git push --force) are tier-gated; globally forbidden patterns (rm -rf /) are blocked unconditionally; blocked commands are still receipted so compliance can prove the system refused.
Anthropic, OpenAI, or local Ollama. Only invoked when L1–L6.5 have not resolved the task. Every L7 success is captured back into L6 pattern memory — so this layer's traffic share decays over the system's lifetime.
Every request is evaluated against a 10-predicate gate before dispatch. Every dispatch is recorded as a hash-chained receipt. A blocked task is still receipted — compliance can prove the system refused.
Size, safety, jailbreak detection, credentials exposure, tier-appropriate dispatch, and six more. A task that fails any gate never reaches a layer. The denial itself is receipted with the failing gate identifier.
A second-layer policy that classifies CLI invocations against a global forbid list and a destructive-command tier table. Every command is matched against the whitelist before subprocess execution.
SHA-256 chain link plus HMAC tag per entry. Tamper-evident, replayable. Receipt verification is a single-pass function over the log file. Auditors can prove the chain has not been edited since write.
Multi-step workflows where stdout of step N is available to step N+1 as {{prev}} or {{step_K.output}}. Fail-fast aborts on any gate-block. Parent and child receipts capture the full audit trail.
Prefix any command with dry: to record intent without execution. Useful for previewing destructive workflows or for compliance walkthroughs that should not mutate state.
Aggregates receipts into per-layer cost and per-tenant usage. Surfaces the L6 hit rate climbing and the L7 hit rate decaying over time — the empirical proof that pattern memory is reducing inference spend.
The pre-dispatch router's classification actively alters dispatch — it is not advisory. fast_path: only L1 runs; L4–L6.5 are skipped. deep_review: cheap layers are skipped; L7 is forced. deny: task is blocked and receipted before gate cycles are spent. standard_path: normal 7-layer cascade. Provider auto-selection: Ollama for trivial and codegen tasks; Anthropic for reasoning and novel tasks — wired from the routing decision, not from caller configuration.
After every completed task, the meta-loop hook records the routing outcome — which layer resolved it, at what cost, with what result. Over time this data surfaces which task types consistently hit expensive layers and allows the routing thresholds to tighten. The system does not just decay cost through pattern memory — it also learns which kinds of tasks need fast-path pinning.
A typical Cascade chain mixes governed CLI calls with deterministic and LLM steps. Every step is receipted with parent-child linkage.
$ python -m cascade.chain # Three-step example
from manager.chain_runner import run_chain
result = run_chain([
"$ gh pr list --limit 5", # L6.5 — governed gh CLI
"Summarize these PRs in 2 sentences:\n{{prev}}", # L6 if pattern hit, else L7
"$ echo summary captured", # L6.5 — terminal sink
], risk_tier="MEDIUM")
→ step 1: passed 10-gate · L6.5 dispatch · receipt 9f3e…
→ step 2: passed 10-gate · L6 pattern hit · receipt b71c… · cost 0
→ step 3: passed 10-gate · L6.5 dispatch · receipt 4e22…
→ chain receipt: a8d1… · parent of 3 children · verify okRoute to the LLM by default. Add hooks before and after. Cost grows with task volume. No first-class hash chain. No pre-execution governance. No mechanism for inference cost to decrease over time.
Route to the cheapest layer that resolves the task. LLM is last resort. Every LLM success becomes a deterministic pattern at L6 — so the next similar request never hits the LLM. Inference cost asymptotes toward zero over the lifetime of the deployment. Provider is auto-selected per task type — Ollama for trivial work, Anthropic only for genuinely novel requests. Hash-chained receipts are the primary substrate, not an afterthought.
The economic flip: LLM vendors are incentivized to grow your bill. Cascade is incentivized to shrink it. Customer pays flat platform fee; your provider invoice declines as pattern memory accumulates. That economic asymmetry is the moat — and the reason this is licensed, not LLM-vendor-marketplaced.
$ python -m pytest tests -q
....s................................................................... [ 16%]
........................................................................ [ 32%]
........................................................................ [ 49%]
........................................................................ [ 65%]
........................................................................ [ 82%]
........................................................................ [ 98%]
...... [100%]
437 passed, 1 skipped in 60.59sVerified 2026-05-21. 71 test files. Governance, gate, CLI adapter, federation, chain runner, cost dashboard, drift detector, autonomic, marketplace verifier, layer health, learner cache, HumanEval subset, executable smoke, integration end-to-end. cascade@0.1.0 · Docker Compose ready · FastAPI control plane included · LICENSE: Proprietary, do not publish.
Pilot engagements stand up Cascade against a representative workload, register your CLIs in the governance registry, wire the receipt chain into your audit pipeline, and walk a cost-decay measurement after 30 days.